← Tea (Tea Dating Advice)

2025 Tea app — Firebase exposure; ~72K images + 1.1M+ DMs (Jul)

2025 1.1M records affected Share on X

Data compromised

First wave (~Jul 25): ~72,000 images including ~13,000 verification selfies/photo IDs (e.g. driver's licenses) plus post/comment/DM images per Malwarebytes/NBC. Second wave (~Jul 28–29): researcher Kasra Rahjerdi showed >1.1 million private messages (early 2023 through Jul 2025) including highly sensitive personal discussions. Tea said initial storage exposure affected users who signed up before Feb 2024; company disabled DMs after the second incident. Catalog indexes 1.1M message corpus as primary attested scale.

Technical writeup

Verified company-acknowledged incidents — July 2025. Tea (teaforwomen.com), a women-focused dating-safety discussion app that topped App Store charts, confirmed unauthorized access after 404 Media reported an exposed Firebase bucket containing verification selfies and driver's-license photos that 4chan users were circulating. Tea said the first storage exposure involved legacy data for users who signed up before February 2024. Days later, independent researcher Kasra Rahjerdi demonstrated access to a messaging database with more than 1.1 million private messages spanning early 2023 through late July 2025; Tea disabled direct messaging and said it had engaged third-party cybersecurity help. BreachHistory indexes the 1.1 million message figure as the primary attested corpus size alongside the ~72,000-image first wave.

Root cause

Misconfigured/exposed Firebase storage and a separate messaging database allowing unauthorized access; verification selfies/IDs and private DMs accessed and partly circulated on 4chan

References

Breaches you may like